pulumi-aws-kotlin/com.pulumi.aws.cloudtrail.kotlin/EventDataStoreArgs

EventDataStoreArgs

data class EventDataStoreArgs(val advancedEventSelectors: Output<List<EventDataStoreAdvancedEventSelectorArgs>>? = null, val billingMode: Output<String>? = null, val kmsKeyId: Output<String>? = null, val multiRegionEnabled: Output<Boolean>? = null, val name: Output<String>? = null, val organizationEnabled: Output<Boolean>? = null, val retentionPeriod: Output<Int>? = null, val suspend: Output<String>? = null, val tags: Output<Map<String, String>>? = null, val terminationProtectionEnabled: Output<Boolean>? = null) : ConvertibleToJava<EventDataStoreArgs>

Provides a CloudTrail Event Data Store. More information about event data stores can be found in the Event Data Store User Guide.

Tip: For an organization event data store you must create this resource in the management account.

Example Usage

Basic

The most simple event data store configuration requires us to only set the name attribute. The event data store will automatically capture all management events. To capture management events from all the regions, multi_region_enabled must be true.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.cloudtrail.EventDataStore("example", {name: "example-event-data-store"});
Content copied to clipboard
import pulumi
import pulumi_aws as aws
example = aws.cloudtrail.EventDataStore("example", name="example-event-data-store")
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
    var example = new Aws.CloudTrail.EventDataStore("example", new()
    {
        Name = "example-event-data-store",
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cloudtrail"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudtrail.NewEventDataStore(ctx, "example", &cloudtrail.EventDataStoreArgs{
			Name: pulumi.String("example-event-data-store"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cloudtrail.EventDataStore;
import com.pulumi.aws.cloudtrail.EventDataStoreArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new EventDataStore("example", EventDataStoreArgs.builder()
            .name("example-event-data-store")
            .build());
    }
}
Content copied to clipboard
resources:
  example:
    type: aws:cloudtrail:EventDataStore
    properties:
      name: example-event-data-store
Content copied to clipboard

Data Event Logging

CloudTrail can log Data Events for certain services such as S3 bucket objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:

Log all DynamoDB PutEvent actions for a specific DynamoDB table

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const table = aws.dynamodb.getTable({
    name: "not-important-dynamodb-table",
});
const example = new aws.cloudtrail.EventDataStore("example", {advancedEventSelectors: [{
    name: "Log all DynamoDB PutEvent actions for a specific DynamoDB table",
    fieldSelectors: [
        {
            field: "eventCategory",
            equals: ["Data"],
        },
        {
            field: "resources.type",
            equals: ["AWS::DynamoDB::Table"],
        },
        {
            field: "eventName",
            equals: ["PutItem"],
        },
        {
            field: "resources.ARN",
            equals: [table&#46;then(table => table&#46;arn)],
        },
    ],
}]});
Content copied to clipboard
import pulumi
import pulumi_aws as aws
table = aws.dynamodb.get_table(name="not-important-dynamodb-table")
example = aws.cloudtrail.EventDataStore("example", advanced_event_selectors=[{
    "name": "Log all DynamoDB PutEvent actions for a specific DynamoDB table",
    "field_selectors": [
        {
            "field": "eventCategory",
            "equals": ["Data"],
        },
        {
            "field": "resources.type",
            "equals": ["AWS::DynamoDB::Table"],
        },
        {
            "field": "eventName",
            "equals": ["PutItem"],
        },
        {
            "field": "resources.ARN",
            "equals": [table&#46;arn],
        },
    ],
}])
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
    var table = Aws.DynamoDB.GetTable.Invoke(new()
    {
        Name = "not-important-dynamodb-table",
    });
    var example = new Aws.CloudTrail.EventDataStore("example", new()
    {
        AdvancedEventSelectors = new[]
        {
            new Aws.CloudTrail.Inputs.EventDataStoreAdvancedEventSelectorArgs
            {
                Name = "Log all DynamoDB PutEvent actions for a specific DynamoDB table",
                FieldSelectors = new[]
                {
                    new Aws.CloudTrail.Inputs.EventDataStoreAdvancedEventSelectorFieldSelectorArgs
                    {
                        Field = "eventCategory",
                        Equals = new[]
                        {
                            "Data",
                        },
                    },
                    new Aws.CloudTrail.Inputs.EventDataStoreAdvancedEventSelectorFieldSelectorArgs
                    {
                        Field = "resources.type",
                        Equals = new[]
                        {
                            "AWS::DynamoDB::Table",
                        },
                    },
                    new Aws.CloudTrail.Inputs.EventDataStoreAdvancedEventSelectorFieldSelectorArgs
                    {
                        Field = "eventName",
                        Equals = new[]
                        {
                            "PutItem",
                        },
                    },
                    new Aws.CloudTrail.Inputs.EventDataStoreAdvancedEventSelectorFieldSelectorArgs
                    {
                        Field = "resources.ARN",
                        Equals = new[]
                        {
                            table.Apply(getTableResult => getTableResult.Arn),
                        },
                    },
                },
            },
        },
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cloudtrail"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/dynamodb"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		table, err := dynamodb.LookupTable(ctx, &dynamodb.LookupTableArgs{
			Name: "not-important-dynamodb-table",
		}, nil)
		if err != nil {
			return err
		}
		_, err = cloudtrail.NewEventDataStore(ctx, "example", &cloudtrail.EventDataStoreArgs{
			AdvancedEventSelectors: cloudtrail.EventDataStoreAdvancedEventSelectorArray{
				&cloudtrail.EventDataStoreAdvancedEventSelectorArgs{
					Name: pulumi.String("Log all DynamoDB PutEvent actions for a specific DynamoDB table"),
					FieldSelectors: cloudtrail.EventDataStoreAdvancedEventSelectorFieldSelectorArray{
						&cloudtrail.EventDataStoreAdvancedEventSelectorFieldSelectorArgs{
							Field: pulumi.String("eventCategory"),
							Equals: pulumi.StringArray{
								pulumi.String("Data"),
							},
						},
						&cloudtrail.EventDataStoreAdvancedEventSelectorFieldSelectorArgs{
							Field: pulumi.String("resources.type"),
							Equals: pulumi.StringArray{
								pulumi.String("AWS::DynamoDB::Table"),
							},
						},
						&cloudtrail.EventDataStoreAdvancedEventSelectorFieldSelectorArgs{
							Field: pulumi.String("eventName"),
							Equals: pulumi.StringArray{
								pulumi.String("PutItem"),
							},
						},
						&cloudtrail.EventDataStoreAdvancedEventSelectorFieldSelectorArgs{
							Field: pulumi.String("resources.ARN"),
							Equals: pulumi.StringArray{
								pulumi.String(table.Arn),
							},
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.dynamodb.DynamodbFunctions;
import com.pulumi.aws.dynamodb.inputs.GetTableArgs;
import com.pulumi.aws.cloudtrail.EventDataStore;
import com.pulumi.aws.cloudtrail.EventDataStoreArgs;
import com.pulumi.aws.cloudtrail.inputs.EventDataStoreAdvancedEventSelectorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var table = DynamodbFunctions.getTable(GetTableArgs.builder()
            .name("not-important-dynamodb-table")
            .build());
        var example = new EventDataStore("example", EventDataStoreArgs.builder()
            .advancedEventSelectors(EventDataStoreAdvancedEventSelectorArgs.builder()
                .name("Log all DynamoDB PutEvent actions for a specific DynamoDB table")
                .fieldSelectors(
                    EventDataStoreAdvancedEventSelectorFieldSelectorArgs.builder()
                        .field("eventCategory")
                        .equals("Data")
                        .build(),
                    EventDataStoreAdvancedEventSelectorFieldSelectorArgs.builder()
                        .field("resources.type")
                        .equals("AWS::DynamoDB::Table")
                        .build(),
                    EventDataStoreAdvancedEventSelectorFieldSelectorArgs.builder()
                        .field("eventName")
                        .equals("PutItem")
                        .build(),
                    EventDataStoreAdvancedEventSelectorFieldSelectorArgs.builder()
                        .field("resources.ARN")
                        .equals(table.arn())
                        .build())
                .build())
            .build());
    }
}
Content copied to clipboard
resources:
  example:
    type: aws:cloudtrail:EventDataStore
    properties:
      advancedEventSelectors:
        - name: Log all DynamoDB PutEvent actions for a specific DynamoDB table
          fieldSelectors:
            - field: eventCategory
              equals:
                - Data
            - field: resources.type
              equals:
                - AWS::DynamoDB::Table
            - field: eventName
              equals:
                - PutItem
            - field: resources.ARN
              equals:
                - ${table.arn}
variables:
  table:
    fn::invoke:
      function: aws:dynamodb:getTable
      arguments:
        name: not-important-dynamodb-table
Content copied to clipboard

Import

Using pulumi import, import event data stores using their arn. For example:

$ pulumi import aws:cloudtrail/eventDataStore:EventDataStore example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(advancedEventSelectors: Output<List<EventDataStoreAdvancedEventSelectorArgs>>? = null, billingMode: Output<String>? = null, kmsKeyId: Output<String>? = null, multiRegionEnabled: Output<Boolean>? = null, name: Output<String>? = null, organizationEnabled: Output<Boolean>? = null, retentionPeriod: Output<Int>? = null, suspend: Output<String>? = null, tags: Output<Map<String, String>>? = null, terminationProtectionEnabled: Output<Boolean>? = null)

Properties

Link copied to clipboard
val advancedEventSelectors: Output<List<EventDataStoreAdvancedEventSelectorArgs>>? = null

The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see Log events by using advanced event selectors in the CloudTrail User Guide.

Link copied to clipboard
val billingMode: Output<String>? = null

The billing mode for the event data store. The valid values are EXTENDABLE_RETENTION_PRICING and FIXED_RETENTION_PRICING. Defaults to EXTENDABLE_RETENTION_PRICING.

Link copied to clipboard
val kmsKeyId: Output<String>? = null

Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.

Link copied to clipboard
val multiRegionEnabled: Output<Boolean>? = null

Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: true.

Link copied to clipboard
val name: Output<String>? = null

The name of the event data store.

Link copied to clipboard
val organizationEnabled: Output<Boolean>? = null

Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: false.

Link copied to clipboard
val retentionPeriod: Output<Int>? = null

The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: 2555.

Link copied to clipboard
val suspend: Output<String>? = null

Specifies whether to stop ingesting new events into the event data store. If set to true, ingestion is suspended while maintaining the ability to query existing events. If set to false, ingestion is active.

Link copied to clipboard
val tags: Output<Map<String, String>>? = null

A map of tags to assign to the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

Link copied to clipboard
val terminationProtectionEnabled: Output<Boolean>? = null

Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: true.

Functions

Link copied to clipboard
open override fun toJava(): EventDataStoreArgs